Change ?all in the SPF record to ~all on Cloudflare

Why it matters

?all says nothing about servers that are not listed, so receivers cannot treat spoofed mail as suspicious on SPF alone. ~all and -all state a real policy.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records, edit the SPF TXT record and change ?all at the end to ~all, then save.
2. Watch your DMARC reports for a few days for legitimate mail that is now marked suspicious, and add any sender that was missing.

Type:     TXT
Name:     example.com
Content:  v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Replace +all in the SPF record with ~all
• Narrow the very large address range in the SPF record
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read